Brocade Communications Systems Brocade ICX 6650 6650 - Manual (Page 306)

286 Brocade ICX 6650 Security Configuration Guide
53-1002601-01
DHCP snooping
1. Enable DHCP snooping on a VLAN.Refer to “Enabling DHCP snooping on a VLAN” on page 286.
2. For ports that are connected to a DHCP server, change their trust setting to trusted.Refer to
“Enabling trust on a port” on page 286.
The following shows the default settings of DHCP snooping.
Enabling DHCP snooping on a VLAN
When DHCP snooping is enabled on a VLAN, DHCP packets are inspected.
DHCP snooping is disabled by default. This feature must be enabled on the client and the DHCP
server VLANs. To enable DHCP snooping, enter the following global command for these VLANs.
Brocade(config)# ip dhcp snooping vlan 2
The command enables DHCP snooping on VLAN 2.
Syntax: [no] ip dhcp snooping vlan vlan-number
The vlan-number variable specifies the ID of a configured client or DHCP server VLAN.
Enabling trust on a port
The default trust setting for a port is untrusted. To enable trust on a port connected to a DHCP
server, enter commands such as the following.
Brocade(config)# interface ethernet 1/1/1
Brocade(config-if-e10000-1/1/1)# dhcp snooping trust
Port 1/1/1 is connected to a DHCP server. The commands change the CLI to the interface
configuration level of port1/ 1/1 and set the trust setting of port 1/1/1 to trusted.
Syntax: [no] dhcp snooping trust
Disabling the learning of DHCP clients on a port
You can disable DHCP client learning on an individual port. To do so, enter commands such as the
following.
Brocade(config)# interface ethernet 1/1/1
Brocade(config-if-e10000-1/1/1)# dhcp snooping client-learning disable
Syntax: [no] dhcp snooping client-learning disable
Use the no form of the command to re-enable DHCP client learning on a port once it has been
disabled.
TABLE 71 Default DHCP snooping settings
Feature Default
DHCP snooping Disabled
Trust setting for ports Untrusted